The security proof of the ping-pong protocol is wrong 
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In 2002, Bostrom and Felbinger presented a novel quantum secure direct communication protocol (named 
often as ping-pong protocol) [1] with a security proof in the case of ideal quantum channel. In this paper, 
VO . we will show that the security proof is wrong in the strict sense. 

^C. ', To prove the security of their protocol, Bostrom and Felbinger assume that Eve adds an ancilla in the 

CN I state Ix) and performs a unitary operation E on the composite system consisting of the travel qubit and 

^ ' the ancilla. Then they worked out the von-Neumann entropy S of the state of the travel qubit after Eve's 

attack operation and after Alice's encoding operation. Von-Neumann entropy S is taken as the maximal 

amount /q of classical information that can be extracted from a state. After some deductions, they got 

function /o(d), where d is the detection probability for Eve's attack. By analyzing /o(d), they conclude 

,,._^ , that any effective eavesdropping attack can be detected. However, it should be emphasized that in Ref.[l] 

l/^ I the /q is extracted from the travel-qubit state. This is clearly stated by Bostrom and Felbinger themselves 

cn 
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Ti^lj- ' system state, then the calculation of S is wrong according to Ref.[2]. As will also lead to the fact that the 

>^ ' security proof is wrong. 

f~^ ■ About Bostrom and Felbinger's proof, there exists a very serious question: Is it reasonable to assume in 

(-H , priori that Eve extracts useful information only from the travel-qubit state and disregards the ancilla state 

Mh. and the composite-system state? Only at a glance, one will answer no, because if the ancilla state and 

_i , the composite-system state are completely useless, then it is completely unnecessary for Eve to introduce 

Cd ' an ancilla. Now let us extensively analyze the above question. Relative to the proof, especially to the 
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analysis of Io{d) in the proof, the question can be transformed into another one. That is, whether /qq 
and Iqc are always not greater than lot for any d, where lot, loa and /qc denote the maximal amounts 
of classical information extracted from the travel-qubit state, the ancilla state and the composite-system 
state, respectively. If the answer is yes, then the priori assumption is of course reasonable, because the 
analysis of Iot{d) is enough for security proof. Otherwise, Bostrom and Felbinger's proof will be quite 
questionable. This is because Ioa{d) and Ioc{d) are not obtained and consequently one does not know 
whether Eve can extract some useful information from the ancilla state or the composite-system state 
and meanwhile faces zero detection probability. In this case, Bostrom and Felbinger's security proof is 
insufficient to support their conclusion that any effective eavesdropping attack can be detected. Of course, 
the proof is unconvinced and one can say the security proof is wrong. Hence, now the key question is 
that whether Joa and /qc are always not greater than Jot for any d. In fact, the key question can be easily 
answered via a simple example. Suppose Bob sends |0) and the ancilla Eve adds is a qubit in the state 
Ix) = -^(|0) + |1)). Then the state of the composite system consisting of the travel qubit and the auxiliary 
qubit is 1^) = -^(|00) + 101)). Assume that the unitary operation E Eve performs on the composite system 
is £; = ^(|00)(00| - |00)(10| + |01)(01| - |01)(11| + |10)(00| -f |10)(10| + |11)(01| + |11)(11|). In this case, 
after Eve's attack operation, the eavesdropping detection probability d is 1/2. Then after Alice's encoding 
operation, /ot — 1 and /qc — 2 can be easily worked out. Apparently, these two values satisfy Ref.[2]'s 
conclusion (i.e., the completely mixed density operator in a n-dimensional space has entropy logj n). Since 
/oc is obviously greater than /o* in the case of d = 1/2, of course, the proof's priori requirement that I^a 
and /qc are always not greater than /ot is denied. Hence, whether Eve can extract some useful information 



from the composite-system state in the case oi d ~ becomes an unsolved question. Accordingly, Bostrom 
and Felbinger's conclusion that any effective eavesdropping attack can be detected is cursory. In the strict 
sense, their so-called security proof of ping-pong protocol in Rcf. [1] is wrong for it docs not indeed indicate 
that the ping-pong can not be eavesdropped in an ideal quantum channel. Incidentally, the recent work[3] 
has already revealed that the ping-pong protocol can be eavesdropped even in an ideal quantum channel, 
as strongly supports the conclusion of this paper. 
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